A hacker has recently stolen $300,000 worth of OHM tokens from OlympusDAO. However, hours later, the attacker sent the money back to the DAO. This implies that they either changed their mind or was a white hat hacker right from the beginning.
The vulnerability was initially announced to the community on Discord early on Friday morning.
It was reported that an exploit surfaced through which the attacker was able to take about 30K OHM from the OHM bond contract at Bond Protocol. “This bug was not found by three auditors, nor by our internal code review, nor reported via our Immunefi bug bounty.”
The sum taken was a portion of the estimated $3.3 million payoff the attacker may have been able to obtain on bug-hunting platform Immunefi for disclosing the exploit, according to Olympus, which claimed that a phased rollout put a “limited amount of funds at risk”.
The affected markets have been shut down, and all other assets are secured, according to Olympus. The DAO group noted in the statement that it was looking into the optimal approach to completely recompense all concerned bonders.
A few hours later, OlympusDAO broke the good news that the hacker had returned all of the assets.
The post stated: “In the upcoming hours, we will communicate regarding the OHM bond payment and our future plans”.
The Olympus Treasury’s holdings consisting of various assets like DAI and FRAX serve as the backing for OHM tokens.
In order to prevent the loss of DAO funds, Olympus has announced a potential $3.3 million bounty directed at Olympus smart contracts and applications since January 2022.
Peckshield, a blockchain security company, claims that the hack specifically targeted a vulnerability in the BondFixedExpiryTeller smart contract. BondFixedExpiryTeller is a logic code that enables autonomous, decentralized apps, and is provided by smart contracts.
PeckShield clarified in a tweet that these are not OlympusDAO contracts, but rather, the affected one was written by Bond Protocol — which was responsible for the pilot launch of OHM bonds.
